Vulnerability-Lookup

GHSA-RP4H-Q5QJ-WRCR

Vulnerability from github – Published: 2026-07-15 00:31 – Updated: 2026-07-15 15:33

Details

An authentication bypass vulnerability exists in certain releases of Ciena Navigator Network Control Suite (NCS), Manage Control Plan (MCP), and Blue Planet products. The issue is caused by improper handling of HTTP request paths and headers, which allows an unauthenticated attacker to manipulate requests in a manner that bypasses authentication and associated audit logging controls.

Severity

9.8 (Critical)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-5270"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-287"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-07-14T23:17:34Z",
    "severity": "CRITICAL"
  },
  "details": "An authentication bypass vulnerability exists in certain releases of Ciena Navigator Network Control Suite (NCS), Manage Control Plan (MCP), and Blue Planet\u00a0products. The issue is caused by improper handling of HTTP request paths and headers, which allows an unauthenticated attacker to manipulate requests in a manner that bypasses authentication and associated audit logging controls.",
  "id": "GHSA-rp4h-q5qj-wrcr",
  "modified": "2026-07-15T15:33:00Z",
  "published": "2026-07-15T00:31:43Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-5270"
    },
    {
      "type": "WEB",
      "url": "https://www.ciena.com/product-security"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

CVE-2026-5270 (GCVE-0-2026-5270)

Vulnerability from cvelistv5 – Published: 2026-07-14 22:24 – Updated: 2026-07-15 12:39

Title

Authentication Bypass in Navigator and Blue Planet Products

Summary

Severity

9.8 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: total

CISA Coordinator (v2.0.3)

CWE

CWE-287 - Improper Authentication

Assigner

Ciena

References

1 reference

URL	Tags
https://www.ciena.com/product-security

Impacted products

7 products

Vendor	Product	Version
CIENA	Navigator NCS	Affected: 8.1
CIENA	MCP	Affected: <= 8.0
CIENA	Planner Plus OnPrem	Affected: <= 4.1
Blue Planet	Inventory	Affected: <=24.04.001 Affected: <=23.12.401 Affected: <=23.08.302 Affected: <=23.04.701
Blue Planet	Orchestration	Affected: <=24.04.2 Affected: <=23.12.3 Affected: <=23.08.4 Affected: <=23.04.2
Blue Planet	Route Optimization & Analysis	Affected: <=24.04.1.2-R Affected: <=23.12.1.6-R Affected: <=23.08.1.6-R Affected: <=23.04.P01-9-R
Blue Planet	Unified Assurance & Analytics	Affected: <=24.04 MR1 Affected: <=23.12 MR3 Affected: <=23.04. MR4

Credits

Special thanks to the team at TDC NET for their contribution.

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 9.8,
              "baseSeverity": "CRITICAL",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-5270",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-15T12:39:26.968950Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-15T12:39:32.248Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Navigator NCS",
          "vendor": "CIENA",
          "versions": [
            {
              "status": "affected",
              "version": "8.1"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "MCP",
          "vendor": "CIENA",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c= 8.0"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Planner Plus OnPrem",
          "vendor": "CIENA",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c= 4.1"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Inventory",
          "vendor": "Blue Planet",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c=24.04.001"
            },
            {
              "status": "affected",
              "version": "\u003c=23.12.401"
            },
            {
              "status": "affected",
              "version": "\u003c=23.08.302"
            },
            {
              "status": "affected",
              "version": "\u003c=23.04.701"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Orchestration",
          "vendor": "Blue Planet",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c=24.04.2"
            },
            {
              "status": "affected",
              "version": "\u003c=23.12.3"
            },
            {
              "status": "affected",
              "version": "\u003c=23.08.4"
            },
            {
              "status": "affected",
              "version": "\u003c=23.04.2"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Route Optimization \u0026 Analysis",
          "vendor": "Blue Planet",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c=24.04.1.2-R"
            },
            {
              "status": "affected",
              "version": "\u003c=23.12.1.6-R"
            },
            {
              "status": "affected",
              "version": "\u003c=23.08.1.6-R"
            },
            {
              "status": "affected",
              "version": "\u003c=23.04.P01-9-R"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Unified Assurance \u0026 Analytics",
          "vendor": "Blue Planet",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c=24.04 MR1"
            },
            {
              "status": "affected",
              "version": "\u003c=23.12 MR3"
            },
            {
              "status": "affected",
              "version": "\u003c=23.04. MR4"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Special thanks to the team at TDC NET for their contribution."
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "An authentication bypass vulnerability exists in certain releases of Ciena Navigator Network Control Suite (NCS), Manage Control Plan (MCP), and Blue Planet\u0026nbsp;products. The issue is caused by improper handling of HTTP request paths and headers, which allows an unauthenticated attacker to manipulate requests in a manner that bypasses authentication and associated audit logging controls."
            }
          ],
          "value": "An authentication bypass vulnerability exists in certain releases of Ciena Navigator Network Control Suite (NCS), Manage Control Plan (MCP), and Blue Planet\u00a0products. The issue is caused by improper handling of HTTP request paths and headers, which allows an unauthenticated attacker to manipulate requests in a manner that bypasses authentication and associated audit logging controls."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-287",
              "description": "CWE-287 Improper Authentication",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-14T22:24:34.750Z",
        "orgId": "7bd90cf1-1651-495e-9ae8-9415fb3c9feb",
        "shortName": "Ciena"
      },
      "references": [
        {
          "url": "https://www.ciena.com/product-security"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eCiena recommends upgrading to the latest\navailable remediated release. For additional details, refer to myciena.com for\ncurrent software versions, fixes, and security advisories.\u003c/p\u003e\n\n\u003cp\u003e\u0026nbsp;\u003c/p\u003e\n\n\u003cp\u003e\u003cb\u003eRemediation\nand Fixes: \u003c/b\u003e\u003c/p\u003e\n\n\u003ctable\u003e\n \u003ctbody\u003e\u003ctr\u003e\n  \u003ctd\u003e\n  \u003cp\u003e\u003cb\u003e\u0026nbsp;Products \u003c/b\u003e\u003c/p\u003e\n  \u003c/td\u003e\n  \u003ctd\u003e\n  \u003cp\u003e\u003cb\u003eRemediated Version\u003c/b\u003e\u003c/p\u003e\n  \u003c/td\u003e\n \u003c/tr\u003e\n \u003ctr\u003e\n  \u003ctd\u003e\n  \u003cp\u003eBP Inventory\u003c/p\u003e\n  \u003c/td\u003e\n  \u003ctd\u003e\n  \u003cp\u003e\u0026gt;=24.08, 24.04.100, 23.12.500, 23.08.400,\n  23.04.800\u003c/p\u003e\n  \u003c/td\u003e\n \u003c/tr\u003e\n \u003ctr\u003e\n  \u003ctd\u003e\n  \u003cp\u003eBP Orchestration \u003c/p\u003e\n  \u003c/td\u003e\n  \u003ctd\u003e\n  \u003cp\u003e\u0026gt;=24.08, 24.04.3 MR3, 23.12.4 MR4,\n  23.08.5 MR5, \u003cbr\u003e\n  23.04.4 MR3\u003c/p\u003e\n  \u003c/td\u003e\n \u003c/tr\u003e\n \u003ctr\u003e\n  \u003ctd\u003e\n  \u003cp\u003eBP Route Optimization \u0026amp; Analysis\u003c/p\u003e\n  \u003c/td\u003e\n  \u003ctd\u003e\n  \u003cp\u003e\u0026gt;=24.08, 24.04.2-3-R, 23.12.2.1-R, 23.08.2.-1-R, \u003cbr\u003e\n  23.04.P02-1-R\u003c/p\u003e\n  \u003c/td\u003e\n \u003c/tr\u003e\n \u003ctr\u003e\n  \u003ctd\u003e\n  \u003cp\u003eBP Unified Assurance \u0026amp; Analytics \u003c/p\u003e\n  \u003c/td\u003e\n  \u003ctd\u003e\n  \u003cp\u003e\u0026gt;=24.08, 24.04.MR2, 23.12.MR4\u003c/p\u003e\n  \u003c/td\u003e\n \u003c/tr\u003e\n \u003ctr\u003e\n  \u003ctd\u003e\n  \u003cp\u003eNavigator NCS\u003c/p\u003e\n  \u003c/td\u003e\n  \u003ctd\u003e\n  \u003cp\u003e\u0026gt;= 8.2, 8.1-P02\u003c/p\u003e\n  \u003c/td\u003e\n \u003c/tr\u003e\n \u003ctr\u003e\n  \u003ctd\u003e\n  \u003cp\u003eMCP\u003c/p\u003e\n  \u003c/td\u003e\n  \u003ctd\u003e\n  \u003cp\u003e8.0-P04, 7.2-P07\u003c/p\u003e\n  \u003c/td\u003e\n \u003c/tr\u003e\n \u003ctr\u003e\n  \u003ctd\u003e\n  \u003cp\u003ePlanner Plus OnPrem\u003c/p\u003e\n  \u003c/td\u003e\n  \u003ctd\u003e\n  \u003cp\u003e\u0026gt;= 4.2, 4.1-P01\u003c/p\u003e\n  \u003c/td\u003e\n \u003c/tr\u003e\n\u003c/tbody\u003e\u003c/table\u003e"
            }
          ],
          "value": "Ciena recommends upgrading to the latest\navailable remediated release. For additional details, refer to myciena.com for\ncurrent software versions, fixes, and security advisories.\n\n\n\n\n\n\u00a0\n\n\n\n\n\nRemediation\nand Fixes: \n\n\n\n\n \n  \n  \n\n\u00a0Products \n\n\n  \n  \n  \n\nRemediated Version\n\n\n  \n \n \n  \n  \n\nBP Inventory\n\n\n  \n  \n  \n\n\u003e=24.08, 24.04.100, 23.12.500, 23.08.400,\n  23.04.800\n\n\n  \n \n \n  \n  \n\nBP Orchestration \n\n\n  \n  \n  \n\n\u003e=24.08, 24.04.3 MR3, 23.12.4 MR4,\n  23.08.5 MR5, \n\n  23.04.4 MR3\n\n\n  \n \n \n  \n  \n\nBP Route Optimization \u0026 Analysis\n\n\n  \n  \n  \n\n\u003e=24.08, 24.04.2-3-R, 23.12.2.1-R, 23.08.2.-1-R, \n\n  23.04.P02-1-R\n\n\n  \n \n \n  \n  \n\nBP Unified Assurance \u0026 Analytics \n\n\n  \n  \n  \n\n\u003e=24.08, 24.04.MR2, 23.12.MR4\n\n\n  \n \n \n  \n  \n\nNavigator NCS\n\n\n  \n  \n  \n\n\u003e= 8.2, 8.1-P02\n\n\n  \n \n \n  \n  \n\nMCP\n\n\n  \n  \n  \n\n8.0-P04, 7.2-P07\n\n\n  \n \n \n  \n  \n\nPlanner Plus OnPrem\n\n\n  \n  \n  \n\n\u003e= 4.2, 4.1-P01"
        }
      ],
      "title": "Authentication Bypass in Navigator and Blue Planet Products",
      "x_generator": {
        "engine": "Vulnogram 1.0.2"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "7bd90cf1-1651-495e-9ae8-9415fb3c9feb",
    "assignerShortName": "Ciena",
    "cveId": "CVE-2026-5270",
    "datePublished": "2026-07-14T22:24:34.750Z",
    "dateReserved": "2026-03-31T19:44:41.118Z",
    "dateUpdated": "2026-07-15T12:39:32.248Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

GHSA-RP4H-Q5QJ-WRCR

CVE-2026-5270 (GCVE-0-2026-5270)

Tags

Sightings

Nomenclature